// security practitioner
Find the risk.
Understand it.
Reduce it.
Notes on cybersecurity from someone who does it for a living — vulnerabilities and CVEs, threat intel worth acting on, ISMS and risk, secure architecture, and the occasional bug bounty write-up. Practitioner analysis, not headlines.
// recent writing
- tls GoAhead Loads the CRL. Doesn't Check It. Happens All the Time. 2026-10-30
- php PHP Workers Never Sleep: Why Memory Reuse in PHP Causes More Bugs Than You Think 2026-10-30
- authentication Auth Bypass by Spoofing: The Pattern That Keeps Returning in Identity Appliances 2026-10-28
- cve CVE-2026-110447: Collabora's Built-In Server Is a Shell Injection Waiting to Happen 2026-10-27
- detection Detection engineering: start from ATT&CK, not logs 2026-10-23
- blog How trinity.sh actually works 2026-10-20
- vulnerability-management CVSS Is a Severity Score, Not a Priority Score — Why EPSS and KEV Matter 2026-10-19
- cve CVE-2026-102764: ARMORY CASTLE's BeyondTrust Zero-Day and the Malware It Left Behind 2026-10-17
- cve CVE-2026-21589: The Shared Library That Exposed Eight Atlassian Products 2026-10-16
- vulnerability-management CVSS Is Not Priority: A Practitioner's Triage Methodology 2026-10-14
- iso27001 93 Controls, One Person: Practical ISO 27001 Without a Compliance Team 2026-10-12
- CVE Citrix NetScaler ADC: Two Zero-Days, One Post-Exploitation Chain 2026-10-12
- nginx Six CVEs from One Maintainer: How Nginx UI's Security Debt Cascaded 2026-10-10
- cve Eleven KEV Additions in One Week: Attackers Are Concentrating 2026-10-07
- vulnerability-management How to Triage a CVE from Raw Feed to Actionable Priority 2026-10-05
- llm Specialization Over Scale: How a Model Fleet Beats a Single Giant 2026-10-05
- cve FortiMail Zero-Day CVE-2026-104286 — Unauthenticated Path Traversal Now KEV 2026-10-02
- CVE Cisco Secure Email Gateway: SQL Injection That Hits Via Email 2026-09-30
- detection Stop Mapping Tools to ATT&CK. Map Behavior. 2026-09-30
- patch-tuesday Patch Tuesday's 974 CVEs: The Wormable Cluster No One Is Talking About 2026-09-29
- cve CVE-2026-85706: From Patch Release to KEV in 24 Hours 2026-09-28
- risk-management Risk Treatment vs. Vulnerability Management: Why Your Patching Strategy Is Wrong 2026-09-23
- ransomware Ransomware in September: Healthcare and Education on the Front Line 2026-09-22
- vulnerability-management EPSS vs KEV: When Exploit Prediction and Active Exploitation Disagree 2026-09-21
- cve CISA's KEV Catalog Just Gave Federal Agencies 72 Hours for Five Critical Flaws 2026-09-16
- cve CVE-2026-85706: GitLab's Commits API Lets Unauthenticated Path Traversal — CISA KEV 2026-09-16
- cloud The Null Entity ID: Why Your SAML IdP Trusts Anyone 2026-09-16
- inventory Your Vulnerability Data Is Only as Good as Your Asset Inventory 2026-09-14
- cve CVE-2026-19490: NetScaler's SAML Action Is Now an Auth Bypass — CISA KEV 2026-09-11
- isms Evidence Decays: Why 'We Do X' Doesn't Survive the Audit 2026-09-09
- cve CVE-2026-55040: SharePoint's JWT Handler Let Anyone Forge a Token — CISA KEV 2026-09-07
- detection Detection Rules That Alert on the Attacker Already Know 2026-09-02
- cve Gitea's diffpatch Flaw Turns a Git Patch Into a Shell — and CISA Says It's Already Being Exploited 2026-08-26
- cve CISA KEV Is a Prioritization Multiplier — Here's How to Use It Properly 2026-08-24
- microsoft-365 Microsoft M365 Is Not Zero-Knowledge — Here's the Evidence (And What Customers Get Wrong) 2026-08-22
- microsoft Storm-0558 Wasn't Microsoft's Worst Security Failure — It Was the Only One 2026-08-22
- cve VMware vCenter Path Traversal Hits KEV — Due Date Is Today 2026-08-21
- risk Risk Treatment Plans That Work (And Why Yours Probably Doesn't) 2026-08-19
- cve Cisco ASA/FTD SSL VPN DoS Is In KEV — 3 Days Past Due 2026-08-17
- cve CISA KEV Catalog: How to Actually Use It (Beyond "Patch the Critical Ones") 2026-08-14
- cve kcp's Unauthenticated Cache Server — When Your Control Plane Leaks Everything 2026-08-12
- vulnerability-management CVSS is Not Priority: A Practical Vulnerability Prioritization Framework 2026-08-10
- cve TeamCity RCE Is In KEV — Due Date Is Today 2026-08-07
- isms 93 Controls, Zero Idealism: ISO 27001 in the Real World 2026-08-05
- cve Cisco FMC Auth Bypass Is In KEV — Here's What Actually Matters 2026-08-03
- architecture Security Debt: Why Architecture Decisions Compound Faster Than Code Debt 2026-07-31
- oauth OAuth 2.0 Access Tokens Actually Mean — What the Spec Says and What It Doesn't 2026-07-29
- cve Three CVSS 10.0 Microsoft CVEs from One Patch Day — And What They Share 2026-07-27
- detection The Three Layers of Logging That Actually Detect Things 2026-07-24
- cve CVE-2026-55454: Appsmith's Caddy Admin API Gets a 9.9 from SSRF 2026-07-22
- isms Configuration Management That Doesn't Rot in Six Months 2026-07-20
- cve CVE-2026-58644: SharePoint Deserialization Hits CISA KEV — 48 Hours to Patch 2026-07-17
- vulnerability-management CVSS, EPSS, KEV — A Prioritization Workflow That Doesn't Lie 2026-07-15
- kubernetes The Invisible Admin: Unauthenticated Endpoints in Kubernetes Infrastructure 2026-07-13
- cve Old CVEs Don't Die, They Get Added to KEV 2026-07-10
- bug-bounty Scope Is the Whole Game 2026-07-06
- bug-bounty A PoC Is a Contract 2026-06-29
- bug-bounty Passive Watchlists Are Not Findings 2026-06-22
- bug-bounty Blocked Is a Result 2026-06-15
- bug-bounty Bug Bounty Needs a Run Loop 2026-06-09
- local-models Same Model, Different Brain: How a ReACT Loop Transformed a 35B Model's Security Skills 2026-03-16
- methodology How I Approach a New Bug Bounty Target 2026-03-11
- bug-bounty When 'Informative' Is the Answer 2026-03-11
- research 0001-01-01
- research 0001-01-01